
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
**** FAVO
A UI library for quickly building pages and UI blocks.
Make sure you have node 8 installed.
nvm use 8
git clone https://github.com/webedx-spark/favo
yarn
yarn start // keep it open
npm link // open a new tab
Open a new tab and run
nvm use 8
cd playground
yarn
yarn start // keep it open
npm link @coursera/favo // open a new tab
Visit http://localhost:3000/ to see demo blocks.
Try to change the block component inside the src folder and see live updates.
src
directorysrc/index.js
playground/src/components/FavoComponentList.js
and add it to render (Good to always add to the top so you don't have to scroll to the bottom to see the change.) Visit http://localhost:3006/favo to see the component.yarn release
to publish a new versioncd static/bundles/xdp
yarn workspace xdp add @coursera/favo@0.0.?
and start importing Favo components.
Ready to publish the components? Run yarn release
and start using the components in production.
yarn build
after adding new package dependencies to FAVO.Components list: (UI blocks, reusable components, design Q&A, web migration, api data mappinging, and ensure web compatibility)
Components list: (UI blocks, design Q&A, web migration, api data mappinging and ensure web compatibility)
May need further design tweaks (including the latest mobile design from Chelsea):
Future work (beyond this sprint)
FAQs
A UI library for quickly building pages and UI blocks.
The npm package favo receives a total of 1 weekly downloads. As such, favo popularity was classified as not popular.
We found that favo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.